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By realizing a quantum cryptography system based on po- 
larization entangled photon pairs we establish highly secure 
keys, because a single photon source is approximated and 
the inherent randomness of quantum measurements is ex- 
ploited. We implement a novel key distribution scheme us- 
ing Wigner's inequality to test the security of the quantum 
channel, and, alternatively, realize a variant of the BB84 pro- 
tocol. Our system has two completely independent users sep- 
arated by 360 m, and generates raw keys at rates of 400 - 
800 bits/second with bit error rates arround 3%. 



The primary task of cryptography is to enable two par- 
ties (commonly called Alice and Bob) to mask confiden- 
tial messages such, that the transmitted data are illegible 
to any unauthorized third party (called Eve). Usually 
this is done using shared secret keys. However, in prin- 
ciple it is always possible to intercept classical key dis- 
tribution unnoticedly n The recent development of quan- 
tum key distributionEl can cover this major loophole of 
classical cryptography. It allows Alice and Bob to estab- 
lish two completely secure keys by transmitting single 
quanta (qubits) along a quantum channel. The underly- 
ing principle of quantum key distribution is that nature 
prohibits to gain information on the state of a quantum 
system without disturbing it. Therefore, in appropriately 
designed schemes, no tapping of the qubits is possible 
without showing up to Alice and Bob. These secure keys 
can be used in a One-Time-Pad protocolo, which makes 
the entire communication absolutely secure. 

Two well known concepts for quantum key distribu- 
tion are the BB84 scheme and the Ekert scheme. The 
BB84 schemeu uses single photons transmitted from Al- 
ice to Bob, which are prepared at random in four partly 
orthogonal polarization states: 0°, 45°, 90°, 135°. If Eve 
tries to extract information about the polarization of the 
photons she will inevitably introduce errors, which Alice 
and Bob can detect by comparing a random subset of the 
generated keys. _ 

The Ekert schepeo is based on entangled pairs and uses 
Bell's inequality^ to establish security. Both Alice and 
Bob receive one particle out of an entangled pair. They 
perform measurements along at least three different di- 
rections on each side, where measurements along parallel 
axes are used for key generation and oblique angles are 



used for testing the inequality. InB, Ekert pointed out 
that eavesdropping inevitably affects the entanglement 
between the two constituents of a pair and therefore re- 
duces the degree of violation of Bell's inequality. While 
we are not aware of a general proof that the violation 
of a Bell inequality implies the security of the system, 
this has been shownB for the BB84 protocol adapted to 
entangled pairs and the CHSH inequality^. 

In any real cryptography system, the raw key gener- 
ated by Alice and Bob contains errors, -which have to 
be corrected by classical error correction! over a public 
channel. Furthermore it has been shown that whenever 
Alice and Bob share a sufficiently secure key, they can e 
hance its security by privacy amplification technique: 
which allow them to distill a key of a desired security 
level. 

A range of experiments have demonstrated the feasi- 
bility of quantum key distribution- including realizations 
using the polarization of photonsQ or the phase of pho- 
tons in long interferometersllj. These experiments have a 
common problem: the sources of the photons are attenu- 
ated laser pulses which have a non- vanishing probability 
to contain two or more photons, leaving .such systems 
prone to the so called beam splitter attacktLil. 

Using photon pairs as produced by parametric down- 
conversion allows us to approximate a conditional single 
photon sourcell3 with a very low probability for_generat- 
ing two pairs simultaneously and a high bit rateEj. More- 
over, when utilizing entangled photon pairs one immedi- 
ately profits from the inherent randomness of quantum 
mechanical observations leading to purely random keys. 

Various experiments with entangled photon pairs have 
already demonstrated that entanglement, can be pre- 
served over distances as large as 10 kmliil, yet none of 
these experiments was a full quantum cryptography sys- 
tem. We present in this paper a complete implementation 
of quantum cryptography with two users, separated and 
independent of each other in terms of Einstein locality 
and exploiting the features of entangled photon pairs for 
generating highly secure keys. 

In the following we will describe the variants of the 
Ekert scheme and of the BB84 scheme which we both 
implemented in our experiment, based on polarization 
entangled photon pairs in the singlet state 
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where photon A is sent to Alice and photon B is sent 
to Bob, and H and V denote the horizontal and vertical 
linear polarization respectively. This state shows perfect 
anticorrelation for polarization measurements along par- 
allel but arbitrary axes. However, the actual outcome 
of an individual measurement on each photon is inher- 
ently random. These perfect anticorrelations can be used 
for generating the keys, yet the security of the quan- 
tum channel remains to be ascertained by implementing 
a suitable procedure. ■— ■ 

Our first scheme utilizes Wigner's inequality^ for es- 
tablishing the security of the quantum channel, in anal- 
ogy to the Ekert scheme which uses the CHSH inequality. 
Here Alice chooses between two polarization measure- 
ments along the axes x an d ip, with the possible results 
+1 and —1, on photon A and Bob between measurements 
along i\) and to on photon B. Polarization parallel to the 
analyzer axis corresponds to a +1 result, and polarization 
orthogonal to the analyzer axis corresponds to —1. 

Assuming that the photons carry preassigned values 
determining the outcomes of the measurements Xt'4 ) t uj 
and also assuming perfect anticorrelations for measure- 
ments along parallel axes, it follows, that the probabil- 
ities for obtaining +1 on both sides, must obey 
Wigner's inequality: 

P++(X>V>) +P++O0,w) -p ++ (x,w) > . (2) 

The quantum mechanical prediction p++ for these 
probabilities at arbitrary analyzer settings a (Alice) and 
(3 (Bob) measuring the ^~ state is 

p q ; n + (a,f3) = ^sin 2 (a- f3) . (3) 

The analyzer settings x = —30°, -0 = 0°, and u> — 30° 
lead to a maximum violation of Wigner's inequality (||): 

^+(-30°, 0°) + ^+(0°, 30°) - p^|(-30°, 30°) = 

= ! + !-§ = -!>o- (4) 

As Wigner's inequality is derived assuming perfect an- 
ticorrelations, which are only approximately realized in 
any practical situation, one should be cautious in ap- 
plying it to test the security of a cryptography scheme. 
When the deviation from perfect anticorrelations is sub- 
stantial, Wignecls inequality has to be replaced by an 
adapted versionE3. 

In order to implement quantum key distribution, Alice 
and Bob each vary their analyzers randomly between two 
settings, Alice: -30°, 0° and Bob: 0°,30° (Figure [j]a). 
Because Alice and Bob operate independently, four possi- 
ble combinations of analyzer settings will occur, of which 
the three oblique settings allow a test of Wigner's in- 
equality and the remaining combination of parallel set- 
tings (Alice= 0° and Bob= 0°) allows the generation of 
keys via the perfect anticorrelations, where either Alice 
or Bob has to invert all bits of the key to obtain identical 
keys. 



If the measured probabilities violate Wigner's inequal- 
ity, then the security of the quantum channel is ascer- 
tained, and the generated keys can readily be used. This 
scheme is an improvement on the Ekert scheme which 
uses the CHSH inequality and requires three settings of 
Alice's and Bob's analyzers for testing the inequality and 
generating the keys. From the resulting nine combina- 
tions of settings, four are taken for testing the inequality, 
two are used for building the keys and three are omitted 
at all. However in our scheme each user only needs two 
analyzer settings and the detected photons are used more 
efficiently, thus allowing a significantly simplified experi- 
mental implementation of the quantum key distribution. 

As a second quantum cryptography scheme we imple- 
mented a variant of the BB84 protocol with entangled 
photons, as proposed in Referenced. In this case, Al- 
ice and Bob randomly vary their analysis directions be- 
tween 0° and 45° (Figure |l]b). Alice and Bob observe 
perfect anticorrelations of their measurements whenever 
they happen to have parallel oriented polarizers, lead- 
ing to bitwise complementary keys. Alice and Bob ob- 
tain identical keys if one of them inverts all bits of the 
key. Polarization entangled photon pairs offer a means to 
approximate a single photon situation. Whenever Alice 
makes a measurement on photon A, photon B is pro- 
jected into the orthogonal state which is then analyzed 
by Bob, or vice versa. After collecting the keys, Alice 
and Bob authenticate their keys by openly comparing a 
small subset of their keys and evaluating the bit error 
rate. 

The experimental realization of our quantum key dis- 
tribution system is sketched in Figure [2| Type-II para- 
metric down-conversion in /3-barium borateES (BBO), 
pumped with an argon-ion laser working at a wavelength 
of 351 nm and a power of 350 mW, leads to the produc- 
tion of polarization entangled photon pairs at a wave- 
length of 702 nm. The photons are each coupled into 
500 m long optical fibers and transmitted to Alice and 
Bob respectively, who are separated by 360 m. 

Alice and Bob both have Wollaston polarizing beam 
splitters as polarization analyzers. We will associate 
a detection of parallel polarization (+1) with the key 
bit 1 and orthogonal detection (—1) with the key bit 
0. Electro-optic modulators in front of the analyzers 
rapidly switch (rise time < 15 ns, minimum switching 
interval 100 ns) the axis of the analyzer between two de- 
sired orientations, controlled by quantum random signal 
generatoralj. These quantum random signal generators 
are based on the quantum mechanical process of split- 
ting a beam of photons and have a correlation time of 
less than 100 ns. 

TheHshotons are detected in silicon avalanche photo 
diodesEJ. Time interval analyzers on local personal com- 
puters register all detection events as time stamps to- 
gether with the setting of the analyzers and the detection 
result. A measurement run is initiated by a pulse from a 
separate laser diode sent from the source to Alice and Bob 
via a second optical fiber. Only after a measurement run 
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is completed, Alice and Bob compare their lists of detec- 
tions to extract the coincidences. In order to record the 
detection events very accurately, the time bases in Alice's 
and Bob's time interval analyzers are controlled by two 
rubidium oscillators. The stability of each time base is 
better than 1 ns for one minute. The maximal duration 
of a measurement is limited by the amount of memory in 
the personal computers (typically one minute). 

Overall our system has a measured total coincidence 
rate of ~ 1700s -1 , and a singles rate of ~ 35000s -1 
. From this, one can estimate the overall detection ef- 
ficiency of each photon path to be 5 % and the pair 
production rate to be 7 • 10 5 s _1 . Our system is very 
immune against a beam splitter attack because the ratio 
of two-pair events is only ~ 3 • 10~ 3 , where a two-pair 
event is the emission of two pairs within the coincidence 
window of 4 ns. The coincidence window in our exper- 
iment is limited by the time resolution of our detectors 
and electronics, but in principle it could be reduced to 
the coherence time of the photons, which is usually of the 
order of picoseconds. 

In realizing the quantum key distribution based on 
Wigner's inequality, Alice's analyzer switch randomly 
with equal frequency between —30° and 0°, and Bob's 
analyzer between 0° and 30°. After a measurement, Alice 
and Bob extract the coincidences for the combinations of 
settings of (-30°, 30°), (-30°, 0°) and (0°,30°), and cal- 
culate each probability. E.g. the probability p ++ (0°, 30°) 
is calculated from the numbers of coincident events C++, 
C+ , C_+, C measured for this combination of set- 
tings by 

We observed in our experiment that the left hand side 
of inequality (§) evaluated to -0.112 ± 0.014. This vio- 
lation of (||) is in good agreement with the prediction of 
quantum mechanics and ensures the security of the key 
distribution. Hence the coincident detections obtained 
at the parallel settings (0°,0°), which occur in a quar- 
ter of all events, can be used as keys. In the experiment 
Alice and Bob established 2162 bits raw keys at a rate 
of 420 bits/ seconded, and observed a quantum bit error 
rate of 3.4 %. 

In our realization of the BB84 scheme, Alice's and 
Bob's analyzers both switch randomly between 0° and 
45°. After a measurement run, Alice and Bob extract the 
coincidences measured with parallel analyzers, (0°,0°) 
and (45°, 45°), which occur in half of the cases, and gen- 
erate the raw keys. Alice and Bob collected ~ 80000 bits 
of key at a rate of 850 bits/second, and observed a quan- 
tum bit error rate of 2.5 %, which ensures the security of 
the quantum channel. 

For correcting the remaining errors while maintaining 
the secrecy of the key, various classical error correction 
and privacy amplification schemes have been developed!! 
We implemented a simple error reduction scheme requir- 
ing only little communication between Alice and Bob. 



Alice and Bob arrange their keys in blocks of n bits and 
evaluate the bit parity of the blocks (a single bit indicat- 
ing an odd or even number of ones in the block). The par- 
ities are compared in public, and the blocks with agree- 
ing parities are kept after discarding one bit per blocked 
Since parity checks only reveal odd occurrences of bit 
errors, a fraction of errors remains. The optimal block 
length n is determined by a compromise between key 
losses and remaining bit errors. For a bit error rate p the 
probability for k wrong bits in a block of n bits is given 
by the binomial distribution P n (k) = (™)p fc (l — p) n ~ k . 

Neglecting terms for three or more errors and account- 
ing for the loss of one bit per agreeing parity, this algo- 
rithm has an efficiency rj(n) = (1 — P n (l))(n — l)/n, 
defined as the ratio between the key sizes after par- 
ity check and before. Finally, under the same approx- 
imation as above, the remaining bit error rate p' is 
p' = (1 - P„(Q) - P„(l))(2/n). Our key has a bit er- 
ror rate p = 2.5 %, for which rj(n) is maximized at n = 8 
with 77(8) = 0.7284, resulting in p' = 0.40 %. Hence, from 
~ 80000 bits of raw key with a quantum bit error rate of 
2.5 %, Alice and Bob use 10 % of the key for checking 
the security and the remaining 90 % of the key to distill 
49984 bits of error corrected key with a bit error rate of 
0.4%. Finally, Alice transmits a 43200 bit large image to 
Bob via the One-Time-Pad protocol, utilizing a bitwise 
XOR combination of message and key data (Figure |^) . 

In this letter wc presented the first full implementation 
of entangled state quantum cryptography. All the equip- 
ment of the source and of Alice and Bob has proven to op- 
erate outside shielded lab-environments with a very high 
reliability. While further practical and theoretical inves- 
tigations are still necessary, we believe that this work 
demonstrates that entanglement based cryptography can 
be tomorrow's technology. 
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FIG. 1. Settings for Alice's and Bob's analyzers for real- 
izing quantum key distribution based either on (a) Wigner's 
inequality or (b) the BB84 protocol. The angular coordinates 
are referenced to the propagation direction of the particle. 
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FIG. 2. The polarization entangled photons are transmit- 
ted via optical fibers to Alice and Bob, who are separated by 
360 m, and both photons are analyzed, detected and regis- 
tered independently. After a measurement run the keys are 
established by Alice and Bob through classical communica- 
tion over a standard computer network. 



Alice's Key 



Bob's Key 



Original: (a) 





Decrypted: (c) 



t 

e- 



Bitwise |v?/: s "| Bitwise 
XOR 1111111$ XOR 

FIG. 3. The 49984 bit large keys generated 
scheme are used to secu*sly transmit an imagel 
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"Venus von Willendorf'^J effigy. Alice encrypts the image 
via bitwise XOR operation with her key and transmits the 
encrypted image (b) to Bob via the computer network. Bob 
decrypts the image with his key, resulting in (c) which shows 
only few errors due to the remaining bit errors in the keys. 
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